0.5.4: x402 set to 2.25.0, deps sweep 2026-09-08

[vvillait88]

Summary

Dependency sweep with one runtime change, so this is a release (0.5.4).

• @x402/core, @x402/evm, @x402/fetch 2.24.0 to 2.25.0, moved as a set (exact pins; fetch nests its own core, so the three stay on one version). Scoped by byte-diffing the shipped dist of each package, chunk names normalized:
  • @x402/evm: the exact-scheme client that pay uses is byte-identical. The only change is the auth-capture escrow contract addresses (v1.1 redeploy), a flow pay does not use.
  • @x402/core: one client-side change, additive: payment results gain an optional extensionResponses read off a response header. No change to accept selection, spend controls, or payment creation. Everything else is server and facilitator side (a FacilitatorCapabilityError, background init handling, server-owned extension info fields).
  • @x402/fetch: only its core range moved.
• @types/node 26.4.1 to 26.5.0.
• Drop the nanoid override: with every override removed and the lock re-resolved, nanoid still lands on 3.3.18, the fixed release for GHSA-2v37-7h3g-55p8. esbuild stays (without it tsup resolves 0.27.7) and viem stays as the coupled-set pin.
• packageManager to bun 1.4.2.

Held on purpose: eslint 9 and TypeScript 6 (org-wide holds); typescript-eslint 8.70.0 and @clack/prompts 1.8.0 are inside the 24h release soak at sweep time and will arrive by dependabot. Not touched: the viem/mppx/@solana/incur coupled set. incur did not move, so the patch stays attached and the serveCli protocol was not re-run. GitHub Actions pins audited and current (cosign-installer v4.1.2 included). OSV scan over the lock: no issues.

Deliberately not done here: a live Base settle through the rebuilt client. The command was prepared but the harness declined to run a real payment from the smoke wallet in this session, so it is owed before the tag is pushed:

./dist/index.js pay POST https://fullenrich.agentscore.com/company/lookup --data '{"domain":"stripe.com"}' --chain base --max-spend 0.10 --json

Supersedes the dependabot PR proposing the same x402 bump.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none. The CLI surface and envelopes are unchanged; the x402 client's new optional extensionResponses field is internal to the payment round-trip.

Test plan

Ran locally on the branch: bun run lint, bun run typecheck, bun run knip, bun run test (574 passed, 2 skipped), bun run build, all exit 0. osv-scanner scan --lockfile bun.lock: 681 packages, no issues. The live Base settle above is not yet run; see Summary.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Live Base settle through the published 0.5.4 release binary (darwin-arm64 asset, reports 0.5.4), run after the tag on 2026-09-08: pay POST https://fullenrich.agentscore.com/company/lookup for stripe.com on x402-base (eip155:8453), payment_status: completed, charged_usd 0.02, order id 405fd08c-b429-4859-b5d9-8b046d7c7a2e, from the smoke wallet 0xeb2Ca790F72787c7e61bC6c861353a1e4ACDFCa5. This is the x402 2.25.0 client path the release moved. Rails exercised: Base only; Tempo and Solana did not move in this release.